AllyHub
Sign in to your cabinet Create account →
Legal · UK-specific privacy notice

UK privacy notice

This notice sits alongside the main privacy notice and gives UK residents the specific detail required by the Information Commissioner's Office guidance.

1. UK data controller

AllyHub Ltd, Companies House 15 619 428, VAT GB 493 617 208, registered at 27 Old Gloucester Street, London WC1N 3AX, United Kingdom, is the UK data controller for the Ally cabinet. Director: James Whittaker. Data Protection Officer: dpo@allyhub.org.

2. Regulator

Our supervisory authority is the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone 0303 123 1113, ico.org.uk. Our registration reference is ZA 947 218.

3. Applicable law

We process personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). Consumer-service aspects fall additionally under the Consumer Rights Act 2015. Electronic communications and cookies fall under the Privacy and Electronic Communications Regulations 2003 (PECR).

4. Legal bases we rely on

5. Your UK rights

Under UK GDPR you may: request access to your data (Art. 15); ask us to correct inaccurate data (Art. 16); ask us to erase your data (Art. 17); restrict processing (Art. 18); receive a portable copy (Art. 20); object to processing (Art. 21); avoid solely-automated decisions with legal effect (Art. 22 — we do not make such decisions about clients). To exercise any right, email dpo@allyhub.org. Our response time is one calendar month; extendable by two further months for particularly complex requests, with reasons given.

6. International transfers from the UK

Personal data may be transferred outside the UK to our processors listed in the main privacy notice. Every transfer relies on: (a) the UK Adequacy Regulations 2021 (for EU/EEA); (b) the UK Extension to the EU-US Data Privacy Framework (for US processors participating); (c) the UK International Data Transfer Agreement (IDTA) with additional safeguards for other jurisdictions. Transfer impact assessments are on file with the DPO and available on request.

7. Cookies under PECR

We use two strictly necessary first-party cookies (aa_sid and aa_c) that do not require consent under PECR regulation 6(4). Any non-essential cookies are asked for by our banner and stored only after affirmative consent. See the cookies policy.

8. Marketing

We do not send unsolicited marketing. Transactional emails (magic-link sign-in, session reminders, invoice receipts) are sent under contract and are not marketing. Any opt-in marketing (product tips, blog highlights) is behaviour you enable in account settings; you can withdraw at any time from the same panel or via one-click unsubscribe in every email.

9. Children

Ally is not offered to under-sixteens. We do not knowingly process children's data. If you believe a minor holds an Ally account, tell the DPO — we will verify and delete.

10. Special-category data

Ally is a mentorship platform. Users sometimes discuss health, beliefs or personal circumstances during sessions. Such content, if written into shared notes or messages, becomes special-category data under UK GDPR Art. 9. Our legal basis is Art. 9(2)(a) explicit consent — by writing such content into your cabinet you consent to its storage on the basis described here. You may delete any note or thread at any time; the cabinet writes to a soft-delete queue that hard-purges within 30 days.

11. Complaints to the ICO

You may lodge a complaint with the ICO at any time, including without contacting us first. However, we welcome the chance to address concerns directly: dpo@allyhub.org.

12. Reviews and updates

This notice is reviewed annually and after any material change to processors, purposes or infrastructure. Version currently in force: 2026.08. Superseded versions available on request from the DPO.

13. Data subject request procedure

To make a subject access request, portability request, correction, deletion or objection request, email dpo@allyhub.org from the email address on your Ally account. Where the request comes from a different address, we ask three verifying questions before releasing personal data (account email, date of most recent session, mentor's first name). This is deliberately identical to the DPO fallback recovery flow to prevent identity abuse.

We do not charge for a first request in any twelve-month period. For repeated or manifestly unfounded requests we reserve the right to charge a reasonable administrative fee based on the actual time spent, per UK GDPR Article 12(5).

14. Automated decision-making

We do not use automated decision-making that produces legal or similarly significant effects for our clients. Mentor matching is algorithmic during intake, but the final choice is always yours from a shortlist we propose. Session pricing is fixed by plan, not personalised.

15. Vulnerable users

Ally is not designed for individuals in acute mental-health crisis. Mentors receive safeguarding training that includes recognising signs of crisis and referring the client to appropriate professional help (Samaritans, GP, NHS 111 in the UK; equivalent services in the EU regions we serve). Where a mentor makes such a referral, only the fact of referral is logged in the cabinet; the specific content is not.

16. Contact for this notice

Questions specific to UK GDPR compliance: dpo@allyhub.org. General enquiries: support@allyhub.org. Post: AllyHub Ltd, 27 Old Gloucester Street, London WC1N 3AX, United Kingdom. Phone: +44 20 3695 4712, weekdays 09:00–17:00 UK time.

© 2024–2026 AllyHub Ltd. Companies House 15 619 428 · VAT GB 493 617 208 · ICO ZA 947 218. Registered office: 27 Old Gloucester Street, London WC1N 3AX, United Kingdom. Jurisdiction: courts of England and Wales.